The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-021543 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    xhci: Remove device endpoints from bandwidth list when freeing the device

    Endpoints are normally deleted from the bandwidth list when they are     dropped, before the virt device is freed.

    If xHC host is dying or being removed then the endpoints aren't dropped     cleanly due to functions returning early to avoid interacting with a     non-accessible host controller.

    So check and delete endpoints that are still on the bandwidth list when     freeing the virt device.

    Solves a list_del corruption kernel crash when unbinding xhci-pci,     caused by xhci_mem_cleanup() when it later tried to delete already freed     endpoints from the bandwidth list.

    This only affects hosts that use software bandwidth checking, which     currenty is only the xHC in intel Panther Point PCH (Ivy Bridge)

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1773048865 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid field-overflowing     memcpy() In preparation for FORTIFY_SOURCE performing compile-time and run-time field bounds checking for     memcpy(), memmove(), and memset(), avoid intentionally writing across neighboring fields. Use flexible     arrays instead of zero-element arrays (which look like they are always overflowing) and split the cross-     field memcpy() into two halves that can be appropriately bounds-checked by the compiler. We were doing:
    #define ETH_HLEN 14 #define VLAN_HLEN 4 ... #define MLX5E_XDP_MIN_INLINE (ETH_HLEN + VLAN_HLEN) ... struct     mlx5e_tx_wqe *wqe = mlx5_wq_cyc_get_wqe(wq, pi); ... struct mlx5_wqe_eth_seg *eseg = &wqe->eth; struct     mlx5_wqe_data_seg *dseg = wqe->data; ... memcpy(eseg->inline_hdr.start, xdptxd->data,     MLX5E_XDP_MIN_INLINE); target is wqe->eth.inline_hdr.start (which the compiler sees as being 2 bytes in     size), but copying 18, intending to write across start (really vlan_tci, 2 bytes). The remaining 16 bytes     get written into wqe->data[0], covering byte_count (4 bytes), lkey (4 bytes), and addr (8 bytes). struct     mlx5e_tx_wqe { struct mlx5_wqe_ctrl_seg ctrl; /* 0 16 */ struct mlx5_wqe_eth_seg eth; /* 16 16 */ struct     mlx5_wqe_data_seg data[]; /* 32 0 */ /* size: 32, cachelines: 1, members: 3 */ /* last cacheline: 32 bytes
    */ }; struct mlx5_wqe_eth_seg { u8 swp_outer_l4_offset; /* 0 1 */ u8 swp_outer_l3_offset; /* 1 1 */ u8     swp_inner_l4_offset; /* 2 1 */ u8 swp_inner_l3_offset; /* 3 1 */ u8 cs_flags; /* 4 1 */ u8 swp_flags; /* 5     1 */ __be16 mss; /* 6 2 */ __be32 flow_table_metadata; /* 8 4 */ union { struct { __be16 sz; /* 12 2 */ u8     start[2]; /* 14 2 */ } inline_hdr; /* 12 4 */ struct { __be16 type; /* 12 2 */ __be16 vlan_tci; /* 14 2 */     } insert; /* 12 4 */ __be32 trailer; /* 12 4 */ }; /* 12 4 */ /* size: 16, cachelines: 1, members: 9 */ /*     last cacheline: 16 bytes */ }; struct mlx5_wqe_data_seg { __be32 byte_count; /* 0 4 */ __be32 lkey; /* 4 4
    */ __be64 addr; /* 8 8 */ /* size: 16, cachelines: 1, members: 3 */ /* last cacheline: 16 bytes */ }; So,     split the memcpy() so the compiler can reason about the buffer sizes. pahole shows no size nor member     offset changes to struct mlx5e_tx_wqe nor struct mlx5e_umr_wqe. objdump -d shows no meaningful object     code changes (i.e. only source line number induced differences and optimizations). (CVE-2022-48744)

  - In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix the behavior of READ near     OFFSET_MAX Dan Aloni reports: > Due to commit 8cfb9015280d (NFS: Always provide aligned buffers to > the     RPC read layers) on the client, a read of 0xfff is aligned up > to server rsize of 0x1000. > > As a     result, in a test where the server has a file of size > 0x7fffffffffffffff, and the client tries to read     from the offset > 0x7ffffffffffff000, the read causes loff_t overflow in the server > and it returns an     NFS code of EINVAL to the client. The client as > a result indefinitely retries the request. The Linux NFS     client does not handle NFS?ERR_INVAL, even though all NFS specifications permit servers to return that     status code for a READ. Instead of NFS?ERR_INVAL, have out-of-range READ requests succeed and return a     short result. Set the EOF flag in the result to prevent the client from retrying the READ request. This     behavior appears to be consistent with Solaris NFS servers. Note that NFSv3 and NFSv4 use u64 offset     values on the wire. These must be converted to loff_t internally before use -- an implicit type cast is     not adequate for this purpose. Otherwise VFS checks against sb->s_maxbytes do not work properly.
    (CVE-2022-48827)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free     This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following     trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref *kref) Bluetooth: chan     0000000023c4974d Bluetooth: parent 00000000ae861c08     ================================================================== BUG: KASAN: use-after-free in
    __mutex_waiter_is_first kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free in
    __mutex_lock_common kernel/locking/mutex.c:671 [inline] BUG: KASAN: use-after-free in
    __mutex_lock+0x278/0x400 kernel/locking/mutex.c:729 Read of size 8 at addr ffff888006a49b08 by task     kworker/u3:2/389 (CVE-2022-50386)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix use-after-free bug     in smp_execute_task_sg() When executing SMP task failed, the smp_execute_task_sg() calls del_timer() to     delete slow_task->timer. However, if the timer handler sas_task_internal_timedout() is running, the     del_timer() in smp_execute_task_sg() will not stop it and a UAF will happen. The process is shown below:
    (thread 1) | (thread 2) smp_execute_task_sg() | sas_task_internal_timedout() ... | del_timer() | ... | ...
    sas_free_task(task) | kfree(task->slow_task) //FREE| | task->slow_task->... //USE Fix by calling     del_timer_sync() in smp_execute_task_sg(), which makes sure the timer handler have finished before the     task->slow_task is deallocated. (CVE-2022-50422)

  - In the Linux kernel, the following vulnerability has been resolved: kernfs: fix use-after-free in
    __kernfs_remove Syzkaller managed to trigger concurrent calls to kernfs_remove_by_name_ns() for the same     file resulting in a KASAN detected use-after-free. The race occurs when the root node is freed during     kernfs_drain(). To prevent this acquire an additional reference for the root of the tree that is removed     before calling __kernfs_remove(). Found by syzkaller with the following reproducer (slab_nomerge is     required): syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x100000, 0x0, 0x0, 0x0, 0x0) r0 =     openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0) close(r0)     pipe2(&(0x7f0000000140)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x800) mount$9p_fd(0x0,     &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x408, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d,     r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@mmap}, {@loose}, {@loose}, {@mmap}],     [{@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@fsmagic={'fsmagic', 0x3d, 0x10001}}, {@dont_hash}]}}) Sample     report: ================================================================== BUG: KASAN: use-after-free in     kernfs_type include/linux/kernfs.h:335 [inline] BUG: KASAN: use-after-free in kernfs_leftmost_descendant     fs/kernfs/dir.c:1261 [inline] BUG: KASAN: use-after-free in __kernfs_remove.part.0+0x843/0x960     fs/kernfs/dir.c:1369 Read of size 2 at addr ffff8880088807f0 by task syz-executor.2/857 CPU: 0 PID: 857     Comm: syz-executor.2 Not tainted 6.0.0-rc3-00363-g7726d4c3e60b #5 Hardware name: QEMU Standard PC (i440FX     + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline]     dump_stack_lvl+0x6e/0x91 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline]     print_report.cold+0x5e/0x5e5 mm/kasan/report.c:433 kasan_report+0xa3/0x130 mm/kasan/report.c:495     kernfs_type include/linux/kernfs.h:335 [inline] kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline]
    __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369 __kernfs_remove fs/kernfs/dir.c:1356 [inline]     kernfs_remove_by_name_ns+0x108/0x190 fs/kernfs/dir.c:1589 sysfs_slab_add+0x133/0x1e0 mm/slub.c:5943
    __kmem_cache_create+0x3e0/0x550 mm/slub.c:4899 create_cache mm/slab_common.c:229 [inline]     kmem_cache_create_usercopy+0x167/0x2a0 mm/slab_common.c:335 p9_client_create+0xd4d/0x1190     net/9p/client.c:993 v9fs_session_init+0x1e6/0x13c0 fs/9p/v9fs.c:408 v9fs_mount+0xb9/0xbd0     fs/9p/vfs_super.c:126 legacy_get_tree+0xf1/0x200 fs/fs_context.c:610 vfs_get_tree+0x85/0x2e0     fs/super.c:1530 do_new_mount fs/namespace.c:3040 [inline] path_mount+0x675/0x1d00 fs/namespace.c:3370     do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount     fs/namespace.c:3568 [inline] __x64_sys_mount+0x282/0x300 fs/namespace.c:3568 do_syscall_x64     arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80     entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f725f983aed Code: 02 b8 ff ff ff ff c3 66 0f 1f 44     00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0     ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f725f0f7028 EFLAGS: 00000246     ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f725faa3f80 RCX: 00007f725f983aed RDX:
    00000000200000c0 RSI: 0000000020000040 RDI: 0000000000000000 RBP: 00007f725f9f419c R08: 0000000020000280     R09: 0000000000000000 R10: 0000000000000408 R11: 0000000000000246 R12: 0000000000000000 R13:
    0000000000000006 R14: 00007f725faa3f80 R15: 00007f725f0d7000 </TASK> Allocated by task 855:
    kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline]     set_alloc_info mm/kasan/common.c:437 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:470     kasan_slab_alloc include/linux/kasan.h:224 [inline] slab_post_alloc_hook mm/slab.h:7 ---truncated---     (CVE-2022-50432)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1788170774 advisory.

  - A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel     privilege escalation from the context of a network service or an unprivileged process. If     sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the     auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network     service privileges to escalate to root or from the context of an unprivileged user directly if a     BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket. (CVE-2021-23133)

  - In the Linux kernel, the following vulnerability has been resolved: drm: Fix use-after-free read in     drm_getunique() There is a time-of-check-to-time-of-use error in drm_getunique() due to retrieving     file_priv->master prior to locking the device's master mutex. An example can be seen in the crash report     of the use-after-free error found by Syzbot:
    https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803 In the report, the master     pointer was used after being freed. This is because another process had acquired the device's master mutex     in drm_setmaster_ioctl(), then overwrote fpriv->master in drm_new_set_master(). The old value of     fpriv->master was subsequently freed before the mutex was unlocked. To fix this, we lock the device's     master mutex before retrieving the pointer from from fpriv->master. This patch passes the Syzbot     reproducer test. (CVE-2021-47280)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix kernel panic during     drive powercycle test While looping over shost's sdev list it is possible that one of the drives is     getting removed and its sas_target object is freed but its sdev object remains intact. Consequently, a     kernel panic can occur while the driver is trying to access the sas_address field of sas_target object     without also checking the sas_target object for NULL. (CVE-2021-47565)

  - In the Linux kernel, the following vulnerability has been resolved: dm btree remove: fix use after free in     rebalance_children() Move dm_tm_unlock() after dm_tm_dec(). (CVE-2021-47600)

  - In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix array-index-out-     of-bounds in pvr2_i2c_core_init Syzbot reported that -1 is used as array index. The problem was in missing     validation check. hdw->unit_number is initialized with -1 and then if init table walk fails this value     remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the     easiest fix for that. hdw->workpoll initialization moved upper to prevent warning in __flush_work.
    (CVE-2022-49478)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    media: uvcvideo: Handle cameras with invalid descriptors(CVE-2023-53437)

    scsi: target: iscsi: Fix a race condition between login_work and the login thread(CVE-2022-50350)

    crypto: cavium - prevent integer overflow loading firmware(CVE-2022-50330)

    HID: core: do not bypass hid_hw_raw_request(CVE-2025-38494)

    tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak(CVE-2022-50389)

    scsi: qla4xxx: Add length check when parsing nlattrs(CVE-2023-53456)

    virtio-mmio: don't break lifecycle of vm_dev(CVE-2023-53515)

    scsi: qla2xxx: Pointer may be dereferenced(CVE-2023-53150)

    tracing/histograms: Add histograms to hist_vars if they have referenced variables(CVE-2023-53560)

    fs: writeback: fix use-after-free in __mark_inode_dirty()(CVE-2025-39866)

    ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS(CVE-2022-50315)

    pnode: terminate at peers of source(CVE-2022-50280)

    drm/sched: Increment job count before swapping tail spsc queue(CVE-2025-38515)

    tracing: Fix race issue between cpu buffer write and swap(CVE-2023-53368)

    usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()(CVE-2022-50544)

    mtd: Fix device name leak when register device failed in add_mtd_device()(CVE-2022-50566)

    ext4: add bounds checking in get_max_inline_xattr_value_size()(CVE-2023-53285)

    tee: fix NULL pointer dereference in tee_shm_put(CVE-2025-39865)

    crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg(CVE-2025-39964)

    do_change_type(): refuse to operate on unmounted/not ours mounts(CVE-2025-38498)

    drm/gem: Acquire references on GEM handles for framebuffers(CVE-2025-38449)

    dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path(CVE-2023-53604)

    qede: confirm skb is allocated before using(CVE-2022-49084)

    recordmcount: Fix memory leaks in the uwrite function(CVE-2023-53318)

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer(CVE-2023-53395)

    usb: net: sierra: check for no status endpoint(CVE-2025-38474)

    posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()(CVE-2025-38352)

    ext4: avoid deadlock in fs reclaim with page writeback(CVE-2023-53149)

    kobject: Add sanity check for kset-kobj.ktype in kset_register()(CVE-2023-53480)

    PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free(CVE-2023-53446)

    tracing: Limit access to parser-buffer when trace_get_user failed(CVE-2025-39683)

    binfmt_misc: fix shift-out-of-bounds in check_special_flags(CVE-2022-50497)

    arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()(CVE-2025-38320)

    udf: Fix uninitialized array access for some pathnames(CVE-2023-53165)

    ext4: avoid crash when inline data creation follows DIO write(CVE-2022-50435)

    serial: 8250: Reinit port-pm on port specific driver unbind(CVE-2023-53176)

    rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails(CVE-2023-53307)

    udf: Do not bother merging very long extents(CVE-2023-53506)

    spi: qup: Don't skip cleanup in remove's error path(CVE-2023-53567)

    calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().(CVE-2025-38181)

    ftrace: Also allocate and copy hash for reading of filter files(CVE-2025-39689)

    xhci: Remove device endpoints from bandwidth list when freeing the device(CVE-2022-50470)

    usbnet: Fix linkwatch use-after-free on disconnect(CVE-2022-50220)

    fs: udf: fix OOB read in lengthAllocDescs handling(CVE-2025-40044)

    blk-mq: use quiesced elevator switch when reinitializing queues(CVE-2022-50552)

    ext4: fix WARNING in mb_find_extent(CVE-2023-53317)

    posix-timers: Ensure timer ID search-loop limit is valid(CVE-2023-53728)

    net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb(CVE-2023-53548)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4188-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
    - CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (bsc#1249857).
    - CVE-2022-50388: nvme: fix multipath crash caused by flush request when blktrace is enabled     (bsc#1250293).
    - CVE-2022-50423: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (bsc#1250784).
    - CVE-2022-50432: kernfs: fix use-after-free in __kernfs_remove (bsc#1250851).
    - CVE-2022-50488: block, bfq: fix possible uaf for 'bfqq->bic' (bsc#1251201).
    - CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
    - CVE-2023-53282: scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write     (bsc#1250311).
    - CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
    - CVE-2023-53395: ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (bsc#1250358).
    - CVE-2023-53500: xfrm: fix slab-use-after-free in decode_session6 (bsc#1250816).
    - CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
    - CVE-2023-53574: wifi: rtw88: delete timer and free skb queue when unloading (bsc#1251222).
    - CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
    - CVE-2023-53673: Bluetooth: hci_event: call disconnect callback before deleting conn (bsc#1251763).
    - CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
    - CVE-2023-53722: md: raid1: fix potential OOB in raid1_remove_disk() (bsc#1252499).
    - CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
    - CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
    - CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
    - CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4189-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2021-4460: drm/amdkfd: Fix UBSAN shift-out-of-bounds warning (bsc#1250764).
    - CVE-2022-48631: ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 (bsc#1223475).
    - CVE-2022-50236: iommu/mediatek: Fix crash on isr after kexec() (bsc#1249702).
    - CVE-2022-50249: memory: of: Fix refcount leak bug in of_get_ddr_timings() (bsc#1249747).
    - CVE-2022-50280: pnode: terminate at peers of source (bsc#1249806).
    - CVE-2022-50293: btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range (bsc#1249752).
    - CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
    - CVE-2022-50350: scsi: target: iscsi: Fix a race condition between login_work and the login thread     (bsc#1250261).
    - CVE-2022-50356: net: sched: sfb: fix null pointer access issue when sfb_init() fails (bsc#1250040).
    - CVE-2022-50367: fs: fix UAF/GPF bug in nilfs_mdt_destroy (bsc#1250277).
    - CVE-2022-50394: i2c: ismt: Fix an out-of-bounds bug in ismt_access() (bsc#1250107).
    - CVE-2022-50395: integrity: Fix memory leakage in keyring allocation error path (bsc#1250211).
    - CVE-2022-50423: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (bsc#1250784).
    - CVE-2022-50443: drm/rockchip: lvds: fix PM usage counter unbalance in poweron (bsc#1250768).
    - CVE-2022-50459: scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() (bsc#1250850).
    - CVE-2022-50481: cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() (bsc#1251051).
    - CVE-2022-50485: ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode (bsc#1251197).
    - CVE-2022-50505: iommu/amd: Fix pci device refcount leak in ppr_notifier() (bsc#1251086).
    - CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
    - CVE-2022-50542: media: si470x: Fix use-after-free in si470x_int_in_callback() (bsc#1251330).
    - CVE-2022-50571: btrfs: call __btrfs_remove_free_space_cache_locked on cache load failure (bsc#1252487).
    - CVE-2023-53183: btrfs: exit gracefully if reloc roots don't match (bsc#1249863).
    - CVE-2023-53185: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (bsc#1249820).
    - CVE-2023-53188: net: openvswitch: fix race on port output (bsc#1249854).
    - CVE-2023-53191: irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains (bsc#1249721).
    - CVE-2023-53204: af_unix: Fix data-races around user->unix_inflight (bsc#1249682).
    - CVE-2023-53271: ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() (bsc#1249916).
    - CVE-2023-53282: scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write     (bsc#1250311).
    - CVE-2023-53289: media: bdisp: Add missing check for create_workqueue (bsc#1249941).
    - CVE-2023-53292: blk-mq: protect q->elevator by ->sysfs_lock in blk_mq_elv_switch_none (bsc#1250163).
    - CVE-2023-53338: lwt: Fix return values of BPF xmit ops (bsc#1250074).
    - CVE-2023-53339: btrfs: fix BUG_ON condition in btrfs_cancel_balance (bsc#1250329).
    - CVE-2023-53373: crypto: seqiv - Handle EBUSY correctly (bsc#1250137).
    - CVE-2023-53433: net: add vlan_get_protocol_and_depth() helper (bsc#1250164).
    - CVE-2023-53476: iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() (bsc#1250839).
    - CVE-2023-53477: ipv6: Add lwtunnel encap size of all siblings in nexthop calculation (bsc#1250840).
    - CVE-2023-53484: lib: cpu_rmap: Avoid use after free on rmap->obj array entries (bsc#1250895).
    - CVE-2023-53517: tipc: do not update mtu if msg_max is too small in mtu negotiation (bsc#1250919).
    - CVE-2023-53519: media: v4l2-mem2mem: add lock to protect parameter num_rdy (bsc#1250964).
    - CVE-2023-53540: wifi: cfg80211: reject auth/assoc to AP with our address (bsc#1251053).
    - CVE-2023-53548: net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb (bsc#1251066).
    - CVE-2023-53556: iavf: Fix use-after-free in free_netdev (bsc#1251059).
    - CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
    - CVE-2023-53582: wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds     (bsc#1251061).
    - CVE-2023-53589: wifi: iwlwifi: mvm: don't trust firmware n_channels (bsc#1251129).
    - CVE-2023-53593: cifs: Release folio lock on fscache read hit (bsc#1251132).
    - CVE-2023-53594: driver core: fix resource leak in device_add() (bsc#1251166).
    - CVE-2023-53596: drivers: base: Free devm resources when unregistering a device (bsc#1251161).
    - CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
    - CVE-2023-53620: md: fix soft lockup in status_resync.
    - CVE-2023-53624: net/sched: sch_fq: fix integer overflow of 'credit' (bsc#1251333).
    - CVE-2023-53635: netfilter: conntrack: fix wrong ct->timeout value (bsc#1251524).
    - CVE-2023-53648: ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer (bsc#1251750).
    - CVE-2023-53687: tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating     clk (bsc#1251772).
    - CVE-2023-53695: udf: Detect system inodes linked into directory hierarchy (bsc#1252539).
    - CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
    - CVE-2023-53707: drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1 (bsc#1252632).
    - CVE-2023-53715: wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex (bsc#1252545).
    - CVE-2023-53717: wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()     (bsc#1252560).
    - CVE-2023-53733: net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode (bsc#1252685).
    - CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).
    - CVE-2025-38680: media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (bsc#1249203).
    - CVE-2025-38691: pNFS: Fix uninited ptr deref in block/scsi layout (bsc#1249215).
    - CVE-2025-38695: scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (bsc#1249285).
    - CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).
    - CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated     (bsc#1249182).
    - CVE-2025-38714: hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (bsc#1249260).
    - CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).
    - CVE-2025-38724: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (bsc#1249169).
    - CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).
    - CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).
    - CVE-2025-39724: serial: 8250: fix panic due to PSLVERR (bsc#1249265).
    - CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).
    - CVE-2025-39772: drm/hisilicon/hibmc: fix the hibmc loaded failed bug (bsc#1249506).
    - CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).
    - CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).
    - CVE-2025-39841: scsi: lpfc: Fix buffer free/clear order in deferred receive path (bsc#1250274).
    - CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).
    - CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).
    - CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).
    - CVE-2025-39923: dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (bsc#1250741).
    - CVE-2025-39929: smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (bsc#1251036).
    - CVE-2025-39931: crypto: af_alg - Set merge to zero early in af_alg_sendmsg (bsc#1251100).
    - CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
    - CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).
    - CVE-2025-39955: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (bsc#1251804).
    - CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
    - CVE-2025-39970: i40e: Fix filter input checks to prevent config with invalid values (bsc#1252051).
    - CVE-2025-39971: i40e: Add bounds check for ch[] array (bsc#1252052).
    - CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).
    - CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
    - CVE-2025-39997: ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (bsc#1252056).
    - CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
    - CVE-2025-40044: fs: udf: fix OOB read in lengthAllocDescs handling (bsc#1252785).
    - CVE-2025-40049: Squashfs: fix uninit-value in squashfs_get_parent (bsc#1252822).
    - CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).
    - CVE-2025-40082: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1252775).
    - CVE-2025-40088: hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (bsc#1252904).

    The following non security issues were fixed:

    - NFSv4.1: fix backchannel max_resp_sz verification check (bsc#1247518).
    - net: hv_netvsc: fix loss of early receive events from host during channel open (bsc#1252265).
    - openvswitch: fix lockup on tx to unregistering netdev with carrier (bsc#1249854)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
315846	Unity Linux 20.1050e Security Update: kernel (UTSA-2026-021543)	Nessus	Unity Linux Local Security Checks	2026/5/20	2026/5/20	high
302981	EulerOS Virtualization 2.13.1 : kernel (EulerOS-SA-2026-1637)	Nessus	Huawei Local Security Checks	2026/3/18	2026/9/18	high
361020	CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1773048865)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	high
359803	CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1788170774)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	high
284771	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2026-1050)	Nessus	Huawei Local Security Checks	2026/1/15	2026/9/19	high
276794	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2025:4188-1)	Nessus	SuSE Local Security Checks	2025/11/25	2026/6/26	high
276910	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2025:4189-1)	Nessus	SuSE Local Security Checks	2025/11/26	2026/6/25	high

检测

插件搜索

high

high

high

high

high

high

high